The American law firm BakerHostetler released a report called “Information Security Occurrence Response Report” in 2022. It mentions that both the number and severity of security incidents are on the rise [1]. After analyzing more than 1,270 events, BakerHostetler discovered that 24% of safety incidents were caused by phishing, and 56% of them were caused by network outages. The remaining 20% of assaults were attributed to accidental disclosure, system errors, and stolen/misplaced data or equipment. Thirty-seven percent of the analyzed occurrences involved ransomware, an increase of 10% over the previous year. This has a wide range of effects, including new and higher expectations for younger medical professionals, new and higher standards for patient convenience and simplicity of participation with their healthcare organization, and the protection of their data. Another important consequence of this new world is the importance of healthcare data security.

According to the Software Advice’s 2022 Healthcare Data Security Survey, 36% of the healthcare companies in the United States have experienced a data breach (Figure 1). In addition, phishing was widespread. Phishing attacks were the primary cause of break-notice obligations, increasing from 43% in 2020 to 60% in 2021 [2–4]. According to many high-profile production network attacks involving outsiders in 2020, the research also noted that merchant-caused incidents were on the rise. The average number of days required to spot an attack was 47 days, which was significantly lower than the 2020 average (92 days). This was partially attributable to the acceptance of more advanced security tools. Overall, it required zero days, down from three days in 2019, and was identical to that of the previous year. The interval between the control and measurable examinations was also shortened; in 2021, it was 30 days, as opposed to 36 days in 2020. At that moment, more than 18,000 solar wind customers had installed the Sunburst update, allowing the remote access Trojans to infect all their client companies and frameworks. The US state, banking, and health departments were among the notable casualties of this attack [5].

Additionally, reports have shown that this malware affects privately held companies, such as FireEye, Intel, Cisco, and Microsoft. As acknowledged by Microsoft, it was difficult to estimate the number of afflicted associations and organizations because of the update’s ability to spread to numerous client devices. Currently, there is no clear indication as to who was responsible for the assault. State-approved programmers in Russia and China have drawn criticism, but the lack of thorough verification encourages further investigation. Software security includes procedures in security architecture to aid maintenance. This indicates that a piece of software is subjected to software security testing before being put on the market to determine its resistance to harmful assaults. Software security aims to build secure software from the ground up without the need for extra security layers. The next stage involves providing users with instructions on how to use the software correctly to fend off attacks. Software security is essential because malware attacks can compromise the availability, validity, and integrity of any software. If programmers consider this earlier rather than later in the development process, the damage can be stopped before it starts [6].

Network security refers to the security between devices connected to the same network. Security of both hardware and software is essential in this situation. To secure a network, businesses search for measures to prevent harmful usage [7]. The devices used in this scenario are the subject of endpoint security. Computers, cell phones, tablets, and other devices are secure in terms of both software and hardware to keep out unauthorized users. User control, software security, and other encryption techniques are widely used for this [8]. Cybersecurity, usually referred to as internet security, is concerned with the usage and transfer of information. Several layers of encryption and authentication are often employed to prevent cybersecurity attacks because information is intercepted during them [9]. It is necessary to protect data flows and devices connected to the same network [10].

The main goal of this study is based on the quantum algorithm as an alternative for evaluating healthcare software security (HSS). The evaluations assessed the security factors of software in the healthcare domain. Software security is necessary for the evolution of quantum computers. A team of researchers (Google and IBM) developed a quantum processor that can easily break the present security mechanisms [9, 11]. The estimation is required for the upgrade mechanism of the software.

Section 2 points out the researcher’s contribution in the area of HSS individually; Section 3 elaborates on the HSS factors and quantum algorithm that may be used for security purposes; Section 4 explains the estimation approach of soft computing, i.e., fuzzy analytic hierarchy process (F-AHP) and fuzzy techniques for order of preference by similarity to an ideal solution (F-TOPSIS); Section 5 compares the evaluation procedure with the classical one; and Section 6 determines the sensitivity analysis of the estimation of HSS. Finally, Section 7 explains the outcomes of the analysis and details the application of the evaluation concerning the future aspects of the results.

In healthcare software (HS) development, security is an essential part of IT-based organizations. The healthcare sector has witnessed significant advancements over the last decade. The evolution of artificial intelligence keeps the healthcare sector more vulnerable. After the development of quantum computers, software security has been at risk in the classical phase. Detailed studies on software security are discussed in this section of the literature review.

Bhavin et al. [12] mentioned that the healthcare sector has the right to know how and why data are being used under the general data protection rule. However, because the Internet is an open channel through which healthcare data move, it is possible for bad things to happen, such as sensitive data being stolen or stored data being changed. Privacy and security are challenging to preserve in traditional healthcare systems. The quantum computing (QC) examines several security architectures for protecting electronic health records and a common encryption scheme based on these facts. Quantum-enabled security algorithms protect data against quantum attacks on the traditional encryption method.

Sanavio et al. [13] stated that QC can perform tasks that were previously unimaginable because it uses quantum bits and the quantum properties of subatomic particles, such as superposition, entanglement, and interference, as well as other fundamentally different ways to process information than traditional computing systems. QC systems promise much faster processing; however, research and development are still in the early stages. QC has not been studied much in important fields such as healthcare, even though it could lead to important advances like faster DNA sequencing, drug development, and other processes that require considerable computing power. In this study, we look at how QC could be used in healthcare systems. QC has the potential to change the way healthcare systems work by making it possible to do complicated calculations faster [14] and identify security weaknesses of traditional cryptography systems. We examine the difficulties hindering the use of QC systems in healthcare and the causes that have contributed to them.

Davids et al. [15] mentioned conceptual extensions of many body systems and quantum computations that have yet to realize their full potential, including quantum clinical medicine and quantum surgery, and discussed QC principles. Advances in precise nanoengineering and new mathematical formalisms for algorithmic design, including quantum mechanics, category theory, quantum algebraic geometry, and others, are laying the groundwork for this intriguing area of medical and future surgical science. The authors predicted that QC would lead to improvements in healthcare, surgery, and medicine.

Malviya and Sundram [16] mentioned that the healthcare sector provides assistance to people fighting against illnesses and disorders. Medical practitioners provide state-of-the-art therapies and drugs to manage illness-related side effects. Patients want a modern, tailored healthcare system that can keep pace with their fast-paced lives. A QC system is a solution to the need for low latency and low energy consumption in real-time health data collection and analysis. QC is a cutting-edge computing technology based on the interesting phenomena of quantum physics and quantum mechanics. In this instance, physics, mathematics, information theory, and computer science are well integrated. It is feasible to attain speeds exponentially faster than those of conventional computers, have a larger processing capacity, consume less energy, and more by changing the behavior of microscopic particles like atoms, electrons, photons, and so on.

QC is growing rapidly, not only because its hardware is faster and can run complicated algorithms more quickly but also because it has a new tool for analyzing data that can solve problems with standard machine learning [17]. It uses ideas from quantum mechanics, such as superposition and entanglement, which have long been used in physics to perform computing tasks that are faster and possibly more complex than those that can be performed with traditional algorithms.

Clinical care and medical research were the first places where computers were used in a new manner. QC has the potential to make computers more powerful and initiate a new era in computer technology. A new era of computing has begun. The potential of QC in enhancing population health, imaging, diagnosis, and treatment is currently based solely on experiments. The use of quantum computers in routine medical and scientific applications has yet to be realized. Many machine learning and artificial intelligence algorithms have the potential to leverage QC to produce findings instantly. Researchers will continue to be the only ones who can use QC until it reaches this level of accessibility [18].

Perumal and Nadar [19] showed and explained that healthcare systems are inherently heterogeneous because each device has a different operating system, platform, and architecture. This variability affects communication latency and security issues. An optimized quantum approach is used to manage keys with the least overhead and decrease threats while simultaneously enhancing healthcare information security. The quantum channel was also used to simulate communication with the key authority. A dedicated quantum channel is used to distribute the generated key, which further improves security by lowering leakage, transmission errors, and eavesdropping. The healthcare user group and the content server communicate with the key server via a quantum channel that sends photons. Numerical data support key generation, optimization, and quantum distribution strategies. To encrypt and decrypt healthcare content, the security of patient data is improved, and quantum simulation estimates in healthcare networks decreased by 90% [19]. In the online healthcare world, the process of sending information between the main and each branch has always been important. In recent years, security checks for network technologies have become increasingly common. A secure and high-capacity information transfer protocol for healthcare cyber services is being developed using quantum algorithms and quantum expansion technology. This innovative technique simultaneously embeds the secret data in three layers and encrypts it. Finally, a quantum channel was used to send extremely secure secret information in the form of a quantum state. This new protocol provides a revolutionary steganography method for quantum images. In essence, the fact that the steganography protocol cannot be observed means that it has a higher level of security that may stop several attacks and make the process of sending information safer [20, 21].

Privacy [P1]: Individual data will only be used privately, and only authorized parties will have access to the requested data [6].

Confidentiality [P2]: Data confidentiality means that only authorized parties can access the information [7].

Availability [P3]: Accessibility is a valid user’s access to resources and information that cannot be forcibly restricted [22].

Auditability [P4]: Appropriateness is a key safety component. For example, audit logs primarily record who accessed which electronic health record (EHR) (or particular personal health record), why they did so, and the timestamp of each life cycle operation [23].

Accountability [P5]: Inappropriate conduct results in an audit and holds the offending person or entity accountable [7].

Authenticity [P6]: The ability to verify the identity of anyone who wants to see sensitive information [24].

Anonymity [P7]: Entities lack a visible identity for privacy-related reasons. Users who are recognized by something other than their own identities or who maintain pseudo-anonymity are more common. Complete secrecy is challenging [24].

Integrity [P8]: Information must be accurate and unaltered by unauthorized parties while being transmitted [25].

3.1 Quantum Alternative (QA)

Developers choose QC algorithms that enable security for future advancements in computing [11]. QA1–QA10 are alternatives for estimating HSS. The details of QA are discussed below:

CRYSTALS-Kyber [QA1], the security of CRYSTALS-Kyber, an IND-CCA2-secure key encapsulation approach, is based on the difficulty of solving the learning-with-errors issue over module lattices. The quantum-safe CRYSTALS-Kyber method is a member of the CRYSTALS (Cryptographic Suite for Algebraic Lattices) family of algorithms. The intrinsic color stability factor is now backing Kyber-1024 Round 2. Advanced Encryption Standard (AES)-256 and Kyber-1024 both strive to be as secure as possible [26].

In Crystals-Dilithium [QA2], the grid-based digital signature architecture of Precious Stones dilithium makes it secure. This is because finding short vectors inside the lattice is difficult. The crystals dilithium digital signature algorithm belongs to the crystals family of algorithms. The size of a polynomial matrix in a crystals dilithium key affects its robustness. For instance, the matrix in crystals is 6 by 5: dilithium (6, 5). As the matrix size increases, the key strength rises. Only digital signatures can be generated and validated using crystals dilithium keys [27].

Falcon [QA3], the fourth standardization protocol, the digital signature algorithm SPHINCS+, was developed with the help of Ward Beullens, another current IBM scientist. Its foundation is the difficulty in obtaining short vectors in NTRU lattices. Dilithium and Falcon have complementary uses, despite being lattice-based digital signature techniques. Falcon has more limited characteristics, whereas dilithium is simpler to construct and use [28]. QC will be the next development in computation, increasing existing computer power to help solve difficult and complex problems. Although we are still developing and investigating the possibilities of quantum technology, we are aware that the two most popular encryption techniques currently in use are not secure against fault-tolerant universal quantum computers [29].

SPHINCS+ [QA4]: The most cautious signature system is SPHINCS+, which relies only on the reliability of the common hash algorithms. Depending on the SPHINCS+ variant used, this strong security assurance comes at the cost of either a fairly large signature size or a fairly long signing time. SPHINCS+ is very similar to the NIST-recommended and IETF-specified state full extended markel signature scheme. SPHINCS+ is ideal for wider use because, unlike XMSS, it is not state-full [30].

BIKE [QA5]: As BIKE employs only transient keys, a fresh key pair is created after every key exchange. Consequently, a GJS attack that depends on noticing numerous unsuccessful decoding attempts for the same private key is useless. We introduce three BIKE variants, referred to as BIKE-1, BIKE-2, and BIKE-3. Despite adhering to either the Niederreiter or McEliece framework, each version does so in significant ways [31].

HQC [QA6]: The Hamming quasi-cyclic (HQC) public-key encryption technique is based on the difficulty of decoding random quasi-cyclic codes in the Hamming metric. This design is similar to that of Alekhnovich’s cryptosystem, which uses ineffective random linear codes. Using repetition-code-tensed BCH codes, Aguilar et al. first suggested the HQC in 2016. In a later study by Aragon et al., the HQC-RMRS two-version, which combines the Reed-Muller and Reed-Solomon codes, was proposed. The NIST standardization process considers the IND-CCA2 KEM variation of HQC-RMRS. This version was produced by transforming the IND-CPA public-key encryption technique using the Fujisaki Okamoto (FO) transform [32].

GeMSS [QA7], an excellent multivariate signature scheme as its name implies, is a small-signature multivariate-based signature scheme. It has a rapid verification procedure and a medium-sized or large public key. GeMSS is a direct successor to QUARTZ and incorporates design ideas from the Gui multivariate signature scheme. The preceding schemes were constructed from the HFE cryptosystem using the so-called minus and vinegar modifiers or HFEv (HFE). It is reasonable to state that HFE and its variations are the most studied schemes in multivariate cryptography [33]. In the Nessie Encrypt competition for public-key signatures, QUARTZ was entered. It creates 128-bit signatures with an 80-bit security level. Unlike many other multivariate methods, QUARTZ has not been actively countered. This is remarkable in light of the lively multivariate scheme cryptanalysis. The most popular attacks used to configure GeMSS remain active. GeMSS is a faster variant of QUARTZ that employs the most recent advancements in multivariate cryptography to outperform QUARTZ while still achieving higher levels of security [34].

The innovative Picnic signature algorithm was built on Picnic [QA8], which uses zero-knowledge proofs rarely used in the real world. One of Picnic’s main architectural ideas, the MPC-in-the-head paradigm, allows cryptographers to quickly create zero-knowledge proofs from multi-party compute protocols. Using symmetric-key cryptography, a person using this signature system creates a key pair, separating the public key from the private key. The signer then adds their signature to the paper to demonstrate that they have the secret key. A verifier can then use the public key to confirm that the signer knows the secret key and that it is not a threat without the signer having to give up the private key. Except for a few of Picnic’s parameter sets [35], the entire process is non-interactive and has been proven to be safe in quantum RAM model 1.

SIKE [QA9]: SIKE is a KEM based on super-singular elliptic curve isogenies. The fundamental key agreement mechanism, Super-singular Isogeny Die Hellman (SIDH), is comparable to classical techniques, such as ECDH and DH, while additionally offering defense against quantum attacks. A fascinating characteristic of SIKE that makes it desirable for situations with constrained bandwidth or storage is that it has the smallest key and cipher text size of any NIST candidate. The main drawback is that it performed somewhat slowly compared to other candidates, which is also stated in the NIST report on contenders for the second round [36]. Therefore, SIKE prioritizes more optimized implementations. For SIKE, efficient implementations are already available for Intel x64, ARMv8-A, and ARMv7-M, and there has been some initial work on AVX512. The effective use of z15 vector instructions to quicken SIKE is of special interest to us [37].

Frodo KEM [QA10]: A family of postquantum key encapsulation systems known as FrodoKEM is both conservative and useful. The difficulty of the learning with errors (LWE) problem determines the security level. Thus, the LWE is connected to difficult problems in ” algebraically unstructured” lattices. The foundation of FrodoKEM is FrodoPKE, which is an LWE public-key encryption technique. The Learning with Errors problem, its hardness against quantum algorithms, and the development of an LWE-based public-key encryption scheme were introduced. FrodoPKE builds on Regev’s earlier work on LWE and is an improved version of the Lindner-Peikert scheme, which was first proposed in 2011. To achieve chosen-ciphertext (IND-CCA) security, FrodoKEM modifies the IND-CPA-secure FrodoPKE technique [38].

Multicriteria decision analyses are based on a hierarchy of factors and their dependence on alternatives. Quantitative analyses of the HSS estimation evaluate the weights and ranks of the factors and alternatives. The artificial approaches of the fuzzified AHP estimate the weights of the factors associated with the HSS, as shown in Figure 2. The artificial approach of the fuzzy TOPSIS evaluates the ranks of the associated alternatives.

We used the hybrid neural approach of F-AHP and F-TOPSIS as soft computing tools for making decisions based on multiple criteria. The FAHP looks at the importance of each factor, while the F-TOPSIS looks at the importance of each alternative [6]. This strategy assesses the variables that affect the perspective of the HSS. The initial weighted values are based on a thorough assessment of the literature. We chose to fulfill our goals using a multi-model dynamic regular technique to assess the aspects associated with HSS. The F-AHP and F-TOPSIS hybrid approaches were used to assess and survey the component weights. F-TOPSIS provides the precise position of the variable relative to the other alternatives. The going with theory fuzzy system was used to accurately assess the items. We chose a soft-computing method to evaluate these factors quantitatively. One of the elements of the F-AHP and F-TOPSIS approaches is item evaluation. To improve the comprehension of the problems and the accuracy of the resources, numerous methodologies and assessment frameworks have been published in hard copies. However, F-AHP is the most effective multi-rule method for calculating the effect of an item’s health. However, F-AHP encounters certain difficulties [24]. To manage crossbreed F-AHP and F-TOPSIS, we merged the F-TOPSIS with a creative management strategy [39]. This unique approach makes it easier to assess the impact factor and its alternatives accurately.

F-AHP is a hybrid soft-computing method that combines F-AHP and F-TOPSIS. This gives the weight of each influencing factor from P1 to P8. From QA1 to QA10, the F-TOPSIS technique ranked the choices. The majority of the time, subjective assessment is adequate for determining how the HSS factors will affect things. It is challenging to quantitatively evaluate HSS. Although a property of order at one level affects one or more qualities at a more significant level, the effects are not the same, as shown in Figure 4. Things might vary. To evaluate this, we converted the aggregated qualities into chains of importance.

Table 2 lists the different security risks P1 to P8, and their FCM weights and BNP are listed in Table 3.

Tables 5–7 display the various values of the subjective cognition results described in the equations, normalized fuzzy decision matrix, and weighted normalized decision matrix, respectively. These values were obtained using the F-TOPSIS approach.

The F-TOPSIS equation in Table 8 indicates the degree of closeness. The various HSS properties were comparable. According to expert judgment and data, the factors (P1 through P8) and attributes (QA1 through QA10) of the HSS are in satisfactory condition pert judgment and data, the factors (P1 through P8) and attributes (QA1 through QA10) of the HSS are in satisfactory condition. Figure 5 shows the degree of proximity.

The same data, results, and output differ when different methodologies are applied. This guaranteed the effectiveness and dependability of the method [22]. In this study, we evaluated the efficacy and precision of the outcome using the F-AHPTOPSIS approach. AHP-TOPSIS uses the same data collection and estimation techniques as fuzzy AHP-TOPSIS; however, no fuzzifications are applied [39]. As a result, for the classic AHP-TOPSIS, the values are taken in their real number form. The distinction between the conventional and fuzzy AHP-TOPSIS results is presented in Table 8 and Figure 6. The results of the F-AHPTOPSIS method and those from the traditional AHPTOPSIS approach had a Pearson correlation coefficient of 0.999176. The F-AHP and F-TOPSIS procedures and methods were superior to the second technique in terms of effectiveness.

Using the sensitivity analyses [41, 42] shown in Table 9, the results were checked as each variable was changed. Sensitivity analysis was performed based on the variables’ weights [43]. Several experiments for each factor with the same number of participants were conducted in our HSS-based investigation to confirm the sensitivity analyses [44, 45]. The satisfaction level (CC-i) was computed using the F-AHPTOSIS method by calculating the weight of each factor (P1–P8 as a constant). The results of the sensitivity analyses are presented in Table 9. The first rows of Table 9 and Figure 7 display the initial weights, whereas Figure 6 displays the first collection of data. According to the initial weights and outcomes, Factor-8 (P1–P8) had a high level of satisfaction (CC-i). Ten experiments were conducted, from QA1 to QA10. The findings of eight studies showed that Factor-8 (P1–P8) still had a high degree of pleasure (CC-i). P2 was also a factor in each experiment and was assigned the least weight. The different correlations between the data show that alternative ratings are weight dependent [46, 47].

Software is becoming increasingly complicated and important in everyday life. However, the main reason why there are so many more data breaches is that there is insufficient security infrastructure that is easy to use. Dominion National, an insurance company, found a nine-year attack on its servers that could have put the personal information of 2.96 million patients at risk. These infractions have led to the theft or exposure of more than 189 million healthcare documents. Therefore, there is an urgent need to evaluate the security of software products using high-quality methods built in. The goal of this investigation was to calculate HSS. To this end, a case study was conducted on six hospital management software companies. To fulfill its goals, this study used ten alternatives in addition to eight security attributes at level I, namely QA1 to QA10, which include QA1, QA2, QA3, QA4, QA5, QA6, QA7, QA8, QA9, and QA10.

The results of this empirical investigation will help experts create software with the correct level of security. Several security models each estimate security in various ways. Nevertheless, few security model options are available for a single product. Furthermore, only a small percentage employ TOPSIS, F-AHP, or other multi-criteria decision-making techniques. The authors used the unified fuzzy AHP-TOPSIS of the MCDM. Fuzzy logic is particularly adept at resolving ambiguous and imprecise information in decision-making challenges; this property of the AHP properly portrays real-world problems and yields better solutions. In addition, TOPSIS supports the selection of the best option from the given options by effectively categorizing alternatives. To attain the best outcomes compared to other MCDM approaches, this study used the combined fuzzy AHP-TOPSIS. According to the findings of this study, the QA6 program provided the highest level of security and user satisfaction among the ten alternatives. The highlights of our study are listed below along with a summary of the results.

Pros: Secure HSS apps can assist programmers and designers in producing superior programs that can completely please users.

• • With the help of the F-AHP-derived results of this study, practitioners can group qualities into groups and choose security design options when making software products.

• • This will provide software products with long-lasting security.

• • Security is a significant problem in the quantum world that is currently unaddressed. This study will serve as the gold standard for app developers to gain a thorough understanding of security architecture.

Changing validity:

• • Finding and choosing attributes for security assessment is neither ideal nor definitive. The number of attributes or specific sets of qualities may have affected the results. Although MCDM techniques may be more suitable for MCDM issues, the combined fuzzy AHP-TOPSIS is a useful tool for security evaluations.

• • In conclusion, this study employed an integrated fuzzy AHP-TOPSIS methodology to assess HSS security.

The powerful fuzzy AHP-TOPSIS Integrated method can be used to evaluate any MCDM problem with numerous parts and options, such as security assessments. Using a quantum computer, we calculated the security factors and estimated the HSS. The necessary weight variables were also assessed. The most recent evaluation of options using TOPSIS was tested for each of the open security options QA1–QA10 (QA6 > QA8 > QA7 > QA9 > QA5 > QA4 > QA10 > QA3 > QA1 > QA2). It was determined that QA-6, the alternative, offered the best possible health and user happiness. The proposed assessment approach enables an HSS to produce high-quality goods for systems with an anticipated level of security.

Table 1. Fuzzy comparison measures (FCM).

Table 2. Fuzzy AHP aggregated pair wise matrix.

Table 3. Weights of factors.

Table 4. Subjective cognition results.

Table 5. Normalized fuzzy-decision matrix.

Table 6. Weighted normalized fuzzy-decision matrix.

Table 7. Closeness coefficients to aspired level among different alternatives.

Table 8. The result of the usual/classical method and F-AHP and F-TOPSIS method.

Table 9. Sensitivity analysis.